Memu Play 6.0.7 has a file permission flaw that allows users with limited privileges to replace the MemuService.exe binary. This executable can be overwritten in the program's installation folder using normal user rights. When the machine restarts, the service runs with system privileges and the replaced binary executes with full administrative rights, giving the attacker arbitrary code execution on the host. The weakness is improper privilege assignment to critical files and is classified as CWE‑306.

The vulnerability affects Memu Play 6.0.7 released by Memuplay. No other versions are reported to contain this flaw.

With a CVSS base score of 9.3, the vulnerability is critical. EPSS data is not available and it is not listed in the CISA KEV catalog. An attacker only needs write access to the installation directory to replace the executable, so the risk is high when standard users can modify files in that location. The local privilege escalation can turn a low‑privilege user into a system administrator after a reboot, providing a straightforward exploitation path once the file replacement occurs.